A convenient way to run CloudGuard WAF Docker is using Azure App Services providing: - Managed Docker Environment - Secure Certificate Store - Scalability ### Prerequisites When configuring CloudGuard WAF Docker Image in Azure App Service you will need to provide an [Azure Integration Subnet](https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration)(a new subnet in your VNet), that allow access to the protected asset. To create an Azure Integration Subnet follow these steps: **Step 1:** Login to [portal.azure.com](https://portal.azure.com/), and search for Virtual Networks **Step 2:** Select the Virtual Network where the protected asset is residing **Step 3:** From the menu on left choose **Subnets** **Step 4:** Create a new Subnet - **Name**: enter a unique name for your subnet - **Subnet address range**: it is recommended to assign at least /24. For more details see [Azure documentation](https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration). Click **Save** ### Configuration #### Step 1: Obtain the registration token from CloudGuard WAF profile Make sure you obtain the from the [Enforcement **Profile**](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point) page, **Authentication** section. you will need it during agent deployment. #### Step 2: Log into App service in Azure Login to [portal.azure.com](https://portal.azure.com/), and search for App Services. #### Step 3: Create a new Web App Click on Create->Web App #### Step 4: Fill "Basics" form details Make sure to select under the **Instance Details** section: - **Name:** enter a unique instance name - **Publish:** choose **Docker Container** - **Operating System:** choose **Linux** - **Region:** choose relevant **Region**(where your application VNETs reside) - **Pricing Plan:** choose relevant Pricing Plan - For Testing it is recommended to use **Basic B3** - For Production it is recommended to use **Premium V3 P1V3**(or stronger) - **Zone Redundancy**: Enable/Disable according to your needs Click **Next** #### Step 5: Fill "Docker" form details **Note**: package file and folder names contain the name appsec - short for "Application Security" provided by CloudGuard WAF. Make sure to select: - **Options:** select **Single Container** - **Image Source:** select **Docker Hub** - **Access Type:** select **Public** - **Image and tag:**`checkpoint/cloudguard-appsec-standalone:latest` - **Startup Command:**`/cloudguard-appsec-standalone --token ` **Note**: The is the token that was retrieved in step 1. Click **Next** #### **Step 6:** Fill "Networking" form details In order to allow access to the virtual network with the protected assets, change **Enable Network Injection** to **On** and select the **Virtual Network** where the protected asset resides. In the **Outbound Access** section, select the **Outbound subnet** to be the Integration Subnet that you created in the Prerequisites section of this page. Click **Review + Create** or if you would like to change some of the other defaults click **Next** #### Step 7: Complete the Web App Deployment and verify an agent was connected successfully Azure App Services will now launch the Docker image and it will connect to the Check Point Cloud. You will get a notification in the Infinity Portal. #### Step 8: Certificates Configuration Azure provides a variety of options to use a certificate. Browse to **App Services**, select the newly created CloudGuard App Service. In the **Overview** Page, **Properties** Tab, click **Add Custom Domain** and in the next screen click again **Add Custom Domain**. You can now choose among the various options. For example to have a Certificate issued automatically by Azure, select **All other domain services,** enter a domain name and follow the instructions. **Step 9: Auto-Scaling (Optional)** Azure App Services provides both **Scale-up** (more CPU/memory) and **Scale-Out**(additional instances) options. It is highly recommended to setup Scale-Out if you have a Production environment which is likely to grow or have traffic bursts. To enable scaling Browse to **App Services**, select the newly created CloudGuard App Service and choose **Scale-up** or **Scale-Out** in the menu. See also [Azure Documentation about Automatic Scaling](https://learn.microsoft.com/en-us/azure/app-service/manage-automatic-scaling?tabs=azure-portal). **Step 10: Health-check (Optional)** Azure App Services allows checking the health of an application. It increases your application's availability by rerouting requests away from unhealthy instances and replacing instances if they remain unhealthy. It does that by accessing every minute a path of your web application of your choice. To enable it, Browse to **App Services**, select the newly created CloudGuard App Service and choose Health-check in the menu. [See also Azure Documentation about Health-check](https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check?tabs=dotnet). **Troubleshooting** For debugging purposes, it is possible to activate an SSH server within the docker container by using the following parameters when running the docker. **For security reasons, it is NOT recommended to use this option in production.**`--ssh-enable --ssh-user --ssh-hash ` The hash of your password can be calculated like this: `openssl passwd -6 -salt ClearTextPassword` 1. _-6 indicates SHA-512_ 2. is to randomize the encryption Note: Azure App Services allows access to the dockers via SSH, but requires that the username must be: **root** and the password must be **Docker!**